0563a10602f59cbe43cc4c575656d030a01c9e5463ebef54993acde100fb1378

Analysis

max time kernel
111s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 12:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ad203e0aa3b816a8c38de65e7ffbbeb0N.exe
Size

83KB
MD5

ad203e0aa3b816a8c38de65e7ffbbeb0
SHA1

7860dbcc16004e25a8352b77298365ad90e68010
SHA256

0563a10602f59cbe43cc4c575656d030a01c9e5463ebef54993acde100fb1378
SHA512

0f13d445f739ba49a8a82a7e66691e5fb712a6477169e473547b181b0c79fb1ffebce42daad88658f7fff9c4833eb13c3024dbf2f32330b088afcc6b6c98ad96
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF++K:LJ0TAz6Mte4A+aaZx8EnCGVu+

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2780-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2780-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2780-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2780-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x0008000000023467-11.dat	upx
behavioral2/memory/2780-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2780-21-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad203e0aa3b816a8c38de65e7ffbbeb0N.exe

C:\Users\Admin\AppData\Local\Temp\ad203e0aa3b816a8c38de65e7ffbbeb0N.exe
"C:\Users\Admin\AppData\Local\Temp\ad203e0aa3b816a8c38de65e7ffbbeb0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-aENFFQqwBN83ioN6.exe

Filesize
83KB

MD5
ec24f448cb7316f3578f093cc8c9d8e1

SHA1
a9b68347a1d428357bc82c8c194f20ed2aa6be3e

SHA256
a53e975cc63d807142b5289ee658a1f60b9c8f512cb8798e720896b2197bd670

SHA512
1ecb4ad3e1f5d6e39dbcb4be47ffd5b2de921ad9170b267c63467f11ea5c95e59e2bf6a274e95168ecec49c6e6e1b3e1d8eae13fb5d4fe39dffad89390632fc6

Download Submit
memory/2780-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2780-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2780-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2780-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2780-12-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2780-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download